|  | 6.1 | Access Control Lists (ACLs)
| 6.1.1 | What are ACLs

ACLs are lists of instructions you apply to a router's interface. These lists tell the router what kinds of packets to accept and what kinds of packets to deny. Acceptance and denial can be based on certain specifications, such as source address, destination address, and port number. ACLs enable you to manage traffic and scan specific packets by applying the ACL to a router interface. Any traffic going through the interface is tested against certain conditions that are part of the ACL. ACLs can be created for all routed network protocols, such as Internet Protocol (IP) and Internetwork Packet Exchange (IPX), to filter packets as the packets pass through a router. ACLs can be configured at the router to control access to a network or subnet. For example, in the Washington School District, ACLs could be used to prevent student traffic from entering the administrative network. ACLs filter network traffic by controlling whether routed packets are forwarded or blocked at the router's interfaces. The router examines each packet to determine whether to forward or drop it, based on the conditions specified in the ACL. ACL conditions could be the source address of the traffic, the destination address of the traffic, the upper-layer protocol, or other information. ACLs must be defined on a per-protocol basis. In other words, you must define an ACL for every protocol enabled on an interface if you want to control traffic flow for that interface. (Note that some protocols refer to ACLs as filters.) For example, if your router interface were configured for IP, AppleTalk, and IPX, you would need to define at least three ACLs. ACLs can be used as a tool for network control by adding the flexibility to filter the packets that flow in or out of router interfaces.
| Threaded Case Study
| Washington Project: Security Requirements The LAN design for all schools in the Washington School District requires that each school have two networks: one for curriculum and the other for administration. Each unique LAN segment should be connected to a separate Ethernet port on the router to service that LAN. Such routers exist; search http://www.cisco.com for more information. As part of the security solution, you need to devise an ACL for the local site access router that will deny users access from the curriculum LAN segment into the administrative LAN segment, yet continue to give the administrative LAN complete access to the curriculum LAN segment. One exception to this ACL is that the router is to pass any Domain Name System (DNS) or e-mail traffic to the DNS/e-mail server, which is located on the administration LAN segment. This is traffic originating on the LAN that is accessed by the students. Therefore, if a student is surfing the Web and needs the DNS server to resolve host names, this ACL will allow for host name resolution. In addition, this ACL will allow students to send and receive e-mail.
| Web Links
| Cisco Connection Online
| Cisco Documentation
| Search Cisco